Add Dependabot Auto-Merge GitHub Action

[jpmilkdagame-ops]

Summary

Describe the problem and fix in 2–5 bullets:

• Problem: Dependabot PRs require manual merging when tests pass
• Why it matters: Saves maintainer time and speeds up dependency updates
• What changed: Added .github/workflows/dependabot-auto-merge.yml to auto-merge Dependabot PRs
• What did NOT change (scope boundary): No changes to CI configuration or other workflows

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #
• Related #
• This PR fixes a bug or regression

Root Cause (if applicable)

N/A

Regression Test Plan (if applicable)

N/A

User-visible / Behavior Changes

• Dependabot PRs will now be automatically merged when CI passes

Diagram (if applicable)

N/A

Security Impact (required)

• New permissions/capabilities? (No)
• Secrets/tokens handling changed? (No)
• New/changed network calls? (No)
• Command/tool execution surface changed? (No)
• Data access scope changed? (No)
• If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

• OS: N/A (GitHub Actions workflow)
• Runtime/container: N/A
• Model/provider: N/A
• Integration/channel (if any): N/A
• Relevant config (redacted): N/A

Steps

1. Create a PR from dependabot[bot]
2. Wait for CI to pass
3. Workflow should auto-merge the PR

Expected

• PR is merged automatically when CI passes

Actual

• (Will be tested when merged)

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant): N/A

Human Verification (required)

What you personally verified (not just CI), and how:

• Verified scenarios: Created the workflow file and validated YAML syntax
• Edge cases checked: None (this is a simple automation workflow)
• What you did not verify: Actual runtime behavior (requires actual Dependabot PR)

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

Compatibility / Migration

• Backward compatible? (Yes)
• Config/env changes? (No)
• Migration needed? (No)
• If yes, exact upgrade steps: N/A

Risks and Mitigations

List only real risks for this PR. Add/remove entries as needed. If none, write None.

• Risk: Dependabot could merge broken PRs if CI passes but tests are insufficient
  • Mitigation: The workflow checks for CLEAN merge state and successful CI completion